Cloudflare Workers AI vs xAI API (Grok)

Cloudflare Workers AI 52

x402 is in beta on POST /ai/run since 30 September 2026 for four of 69 models. It still needs a Cloudflare API token, a United States account and a card on file, and the per-model and OpenAI-style routes are not covered. We did not call it (12 of 40). Per-model token, image and audio prices and the neuron rate are published without a login (20). 10,000 neurons a day are free on the Workers Free plan, and the pricing page asks for a paid plan only past that. We did not sign up to confirm that no card is asked for (20). A person creates the account and the first token in a browser, and the x402 route needs both (0). The Machine Payments page (last updated 30 September) and the pricing page (20 October) were re-read on 1 November and say the same. 12 + 20 + 20 + 0 = 52.

xAI API (Grok) 20

No x402, MPP or L402 (0). Per-token and per-call prices published without a login on docs.x.ai/developers/pricing (20). No free tier found for the text API, and the quickstart says to load the account with credits (0). Sign-up is in the browser at console.x.ai. The Management API can create keys and top up prepaid credit, but only with a management key made by a person in the console, so no line credit (0).

Cloudflare Workers AI 80

Model reading. Cloudflare API tokens are revocable, limited to Workers AI Read or Edit on chosen accounts, and take an expiry and an IP address filter. Permission is per account, not per model, and the API reference also accepts the older global API key (27 of 30). The data usage page and the service-specific terms of 28 September 2026 say Customer Content is not used to train models without consent. The data page adds that it is not used to improve services, while clause 9 of the same terms section allows use as needed to provide and improve the Services (17 of 20). The data page says content may be stored if a storage service is used with Workers AI. It gives no retention period for inference inputs and no explicit zero-retention statement, and AI Gateway logs prompts and responses by default when a call is routed through a gateway (9 of 15). Gateway logs record prompt, response, tokens and cost per request, and the dashboard shows neuron usage. Direct calls have no per-request log that we found, and account audit logs were not read this run (9 of 15). security.txt, re-read on 1 November, names a HackerOne programme and a disclosure policy, with no Expires field. Cloudflare's ISO certifications page, read on 1 November, says Cloudflare is certified to ISO 27001 (since 2019, now to its 2022 edition), ISO 27018 and ISO 27701, with a scope of the Cloudflare global cloud platform, which doesn't name Workers AI. 2 held back for the missing Expires field, which RFC 9116 requires, the reading cloudflare-r2 gave the same evidence on 1 November (18 of 20, 15 before, when certifications went unread). 27 + 17 + 9 + 9 + 18 = 80.

xAI API (Grok) 97

Model reading. Team API keys with ACLs per endpoint and per model, QPM and TPM caps, expiry, and create, rotate, disable and delete through the Management API, plus documented mTLS. GitHub secret scanning disables leaked keys and emails the owner (30). The security FAQ says SpaceXSI never trains on API inputs or outputs without explicit permission (20). Requests and responses are kept 30 days for abuse auditing, then deleted, and team admins can switch on zero data retention themselves, confirmed by an x-zero-data-retention header on every response (15). Console audit log and a Management API audit-events endpoint, plus optional per-key request logging (15). security.txt valid to 2027-06-29 with a HackerOne bug bounty and a separate safety contact for prompt-injection issues. SOC 2 Type 2 is claimed in the security FAQ with the reports behind an NDA in the trust centre, so 17 of 20. Remote MCP doesn't support require_approval, which the model checklist doesn't score but reviewers should see. New in October, a guidelines array lets the caller make the model decline nsfw, violence or profanity content, which the checklist doesn't score.

Cloudflare Workers AI 75

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). OpenAI-style tool calling with parallel_tool_calls on models tagged for it, and embedded function calling in Workers. The changelog of 17 February 2026 fixed six faults, five of them in tool-call round trips (15 of 20). json_object and json_schema formats. The docs say schema adherence is not guaranteed and JSON Mode does not stream, and the page's list of six supported models names three that were retired in May (9 of 15). Prefix caching on by default for select models, x-session-affinity, cached counts in usage and published cached prices (12 of 15). 1,048,576 tokens on DeepSeek V4 and GLM-5.3 and 256,000 on Gemma 4, against 24,000 on Llama 3.3 70B fast (12 of 15). An asynchronous batch route on tagged models with a 10 MB payload limit and no stated discount (7 of 10). The OpenAI SDKs work with a changed base URL, with Responses limited to two models and no streaming. Cloudflare's own SDKs cover TypeScript, Python and Go (9 of 10). Errors carry an internal code and message, and a 429 tells a spent allocation from a capacity limit (11 of 15).

xAI API (Grok) 90

Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). Function calling with parallel calls on by default and tool_choice of auto, required, none or a named function (20). Guaranteed structured outputs (15). Automatic prompt caching, cached input at 0.25x on grok-4.7 ($0.50 per million) and 0.16x on grok-4.3 (15). 500,000-token context on grok-4.7 and 1,000,000 on grok-4.3, 13 of 15 for the default model's 500K. The Batch API is now 20% off on grok-4.7, 4.6 and 4.5 as well as the older models, with batch requests outside the rate limits (10 of 10, up from 5 on 6 October). One first-party SDK, xai-sdk for Python, with the OpenAI SDKs and Vercel's AI SDK documented as alternatives (5 of 10). Status codes documented with fixes, no Retry-After header found (12 of 15).

Cloudflare Workers AI 68

Hosted reading. www.cloudflarestatus.com is a Statuspage with Workers AI, AI Gateway and API as separate components (20). The incidents feed read on 9 October held 50 incidents from 21 September to 8 October 2026, none naming Workers AI or AI Gateway. The feed read on 1 November holds 50 incidents from 16 to 31 October. Workers AI is listed only in "Issues with AI Security for Apps" on 27 October, intermittent failures in unsafe topic detection with impact none, resolved after 38 minutes. The 23 October network incident, labelled major, describes some traffic between Ashburn and Atlanta and some customers in North America, so it reads as partial, as this run's other Cloudflare re-checks read regional incidents. The history page loads by script, so 3 August to 20 September and 9 to 15 October went unread. The 28 July changelog that cited 429 and 3040 capacity errors has left the 90 days, so the line is 12 of 30 (10 before), as cloudflare-r2 and cloudflare-mcp read the same page with an unread stretch on 1 November. Limits are published per task type, 300 requests a minute for text generation and 20 or 50 a minute per paid model, unchanged since 17 September (15). A 429 carries code 3036 for a spent free allocation or 3040 for capacity, rejectIfBusy fails fast, the batch route queues work, and the Cloudflare API returns retry-after and Ratelimit headers for its own limit. No Retry-After or backoff figures were found for a 3040 (11 of 15). No SLA for Workers AI was found. The legal index names only an enterprise support and SLA page, which we did not read (0). The limits page says Workers AI is generally available, with lower limits possible on beta models (10). 20 + 12 + 15 + 11 + 0 + 10 = 68.

xAI API (Grok) 55

Status page at status.x.ai with components for the global and US API endpoints, voice, the consumer apps and, since the Cursor merger, Cursor's services, with an RSS feed (20). The feed, read on 6 November, now holds 267 incidents back to 11 August, so the whole 90-day window is readable. On the API components there were high error rates on grok-4.6 and grok-4.5 from 21:57 to 23:28 UTC on 17 August (about 90 minutes) and a models outage on the global and US endpoints from 13:30 to 17:09 UTC on 3 September (about 3 hours 40 minutes), so several majors. A 26-minute datacenter outage across the API on 22 September, voice disruptions of 12 and 28 minutes on 10 September and 6 October, a 63-minute voice and Imagine degradation on 30 October and a 37-second model degradation on 24 October add to the record (0). Rate limits published per model and tier, grok-4.7 at Tier 0 is 150 requests a second and 50M TPM, with the per-second cap derived as RPM divided by 48 (15). The rate-limits page shows exponential backoff on 429, but no Retry-After header or overload guidance was found (10 of 15). No SLA found in the docs or llms.txt (0). The Responses API has been GA since September 2025 and grok-4.7 carries no preview label (10).

Cloudflare Workers AI 76

Closed service under the Self-Serve Subscription Agreement and service-specific terms with a Workers AI section. The hosted models are open-weight with licence links on their pages, and the SDKs are Apache-2.0 and MIT (18 of 30). The data usage page, the service-specific terms and the privacy policy of 4 November 2025 agree on ownership and no training. The privacy policy gives retention criteria, not periods, the two documents differ on use to improve services, and the DPA the terms link was not read (20 of 30). No deprecation policy was found. The changelog posts dated notices, among them the 21 October deprecation of workers-ai-provider with no end date, and section 8 of the agreement lets Cloudflare modify or discontinue a service without notice (8 of 20). A sub-processor page exists and links a list for Cloudflare services, which we did not read. Model pages are tagged Cloudflare-hosted, and where a request runs is not stated beyond Cloudflare's network (10 of 20). 18 + 20 + 8 + 10 = 56.

xAI API (Grok) 63

Closed service under xAI's enterprise terms, with the Python SDK under Apache-2.0 (15). The docs agree with each other on no training, 30-day abuse retention, 30-day storage of stateful responses and the ZDR route, but the privacy policy, enterprise terms and DPA at x.ai/legal answered a Cloudflare block page on 6 October and again on 6 November, so they couldn't be compared (15 of 30). Dated migration guides and redirect tables for each retirement, but no written deprecation policy, and Chat Completions, Anthropic compatibility and grok-voice-2.0 are labelled deprecated with no date (12 of 20). The US regional endpoint states what stays in the US, the global endpoint guarantees no region, and no subprocessor list was readable (10 of 20).

Cloudflare Workers AI 80

Model reading, scored on the API lines. Cloudflare's public OpenAPI 3.0.3 document, updated 8 October 2026, has 14 paths and 15 operations under /ai/. /ai/run/{model_name} takes 13 input shapes by task and lists only 200 and 400 responses, and the OpenAI-style /ai/v1/ routes are not in it. Each model page links JSON Schemas for input and output, and GET /ai/models/schema returns them (22 of 25). llms.txt for Workers AI and a Markdown copy of every page (10). Model pages give a description, capability tags, context window and price, and the batch, caching and reject-busy pages say when to use each. Nothing says when not to pick a model (14 of 20). Parameters are typed with defaults, enums and nullability on the model pages (12 of 15). TypeScript, Python and curl examples on every model page and a table of 17 error codes with HTTP statuses. The quick start and the OpenAI page still use @cf/meta/llama-3.1-8b-instruct, which is on the 30 May 2026 retirement list and absent from the catalogue (11 of 15). A dated product changelog with RSS. Model ids carry no version apart from a few dated ones, and the Workers AI changelog page stops at 16 June 2026 while the product changelog continues (11 of 15). The OpenAPI document was not re-read on 1 November. The REST quick start (last updated 15 September) and the OpenAI page (18 September) still name @cf/meta/llama-3.1-8b-instruct on 1 November, and the error table still has 17 codes.

xAI API (Grok) 88

OpenAPI 3.1 document at docs.x.ai/openapi.json, 39 paths and 205 schemas on 6 November, covering Responses, Chat Completions, files, images, videos and models. The batch endpoints documented in the REST reference still aren't in it (20 of 25, applied as for gemini-api's missing Interactions API). llms.txt and a Markdown twin of every page, plus a docs MCP server (10). The models page says which model to use for code, chat, images, video and voice, and reference pages list each parameter. Reference not read in full (18 of 20). Structured outputs are guaranteed to match the schema for supported keywords, and tool arguments always conform with strict implicitly true (15). Examples in Python, JavaScript and curl on every guide. The debugging page lists status codes with fixes, but the cause cells for 400, 403, 404 and 415 are still empty (13 of 15). Release notes are grouped by month without day dates, and model slugs come as aliases and dated versions (12 of 15).